CVE-2021-22119
HIGH 7.5EPSS 6.0%
Spring Security versions 5.5.x prior to 5.5.1, 5.4.x prior to 5.4.7, 5.3.x prior to 5.3.10 and 5.2.x prior to 5.2.11 are susceptible to a Denial-of-Service (DoS) attack via the initiation of the Authorization Request in an OAuth 2.0 Client Web and WebFlux application. A malicious user or attacker can send multiple requests initiating the Authorization Request for the Authorization Code Grant, which has the potential of exhausting system resources using a single session or multiple sessions.
- Affected
- Spring Security
- CVSS v3.1 NVD
- 7.5 HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS v2.0 NVD
- 5.0 MEDIUM
AV:N/AC:L/Au:N/C:N/I:N/A:P - EPSS
- 6.00% chance of exploitation in the next 30 days, 93rd percentile
- Published
- 2021-06-29
- Updated
- 2024-08-03
Proof-of-concept exploits (1)
- mari6274/oauth-client-exploit1★ · 2021-11-02
Security advisories
- https://tanzu.vmware.com/security/cve-2021-22119
- https://www.oracle.com/security-alerts/cpujan2022.html
- advisories/GHSA-w9jg-gvgr-354m
- https://www.oracle.com/security-alerts/cpujul2022.html